Operation Endgame Disrupts StealC and Amadey Malware as Microsoft Uses AI and a RICO Suit to Treat Them as One Conspiracy

Overview

Law enforcement and private-sector partners struck three interlinked “cybercrime as a service” operations on June 24, 2026, dismantling the infrastructure behind the StealC and Amadey malware families and the SocGholish loader, according to The Record. As part of the Europol-coordinated Operation Endgame, authorities took action against 326 servers and 142 domains and recovered roughly 27 million stolen credentials, Help Net Security reported. Alongside the takedown, Microsoft filed civil racketeering claims that, with the help of AI analysis, treat two separately developed malware suites as a single criminal conspiracy.

What We Know

The action was announced on June 24, 2026, according to The Record. Law enforcement and private-sector partners actioned 326 servers and 142 domains, and authorities identified and froze over 41 million euros (approximately 47 million US dollars) in related crypto assets, Help Net Security reported. Nearly 27 million stolen login credentials were tracked down in the operation.

The scale of the underlying infection was substantial. Amadey and StealC were tied to more than 140,000 infected computers worldwide in the first two weeks of May 2026 alone, according to The Record. Microsoft pinpointed over 18,000 victim computers and severed criminal control of them, per Help Net Security.

The two families play complementary roles. “Amadey and StealC are often used alongside each other: Amadey helps attackers gain access to devices, while StealC steals passwords and sensitive information,” stated Steven Masada, Assistant General Counsel with Microsoft’s Digital Crimes Unit, as quoted by Help Net Security. The StealC infostealer captures “passwords, cookies and session tokens,” according to The Record.

The third target, SocGholish, is a malware loader linked to the Russian cybercrime group Evil Corp, according to CyberInsider. Also called FakeUpdates, it spreads through phony browser updates served from compromised websites, The Record reported; investigators remediated 14,971 compromised websites distributing fake browser update prompts, according to CyberInsider.

The effort drew in agencies and firms across multiple countries. Europol announced the operation and coordinated the multinational effort, with law enforcement from Canada, Denmark, Germany, the Netherlands, the UK, and the US participating, according to CyberInsider. Europol and Eurojust were joined by private-sector partners including Microsoft’s Digital Crimes Unit, Proofpoint, and IBM X-Force, Help Net Security reported.

The AI and RICO Angle

Microsoft paired the disruption with a legal strategy that hinged on AI-assisted analysis. The company filed civil RICO claims against five defendants allegedly involved in both malware operations, according to The Register. Court documents describe the defendants as “a group of cybercriminals operating a Malware as a Service enterprise that leverages malicious software commonly known as the Amadey Malware Suite and StealC Malware Suite.”

The breakthrough was the discovery that the two families, though developed separately, shared the same infrastructure — a connection that let Microsoft’s legal team treat them as components of a single conspiracy under racketeering statutes, The Register reported. “We used Copilot and other AI tools to analyze both malwares and their infrastructure, asking questions in plain English instead of manually combing through complex code,” Masada said. The approach allowed investigators to “surface key details, uncover hidden data, and test findings in a fraction of the time, turning what would have taken hours or days into minutes.”

For its part of the action, Microsoft identified over 200 malicious Amadey and StealC command-and-control domains and IPs, according to the Microsoft Security Blog. Microsoft noted that stolen credentials collected by infostealers frequently become the entry point for ransomware attacks and account compromise campaigns.

What We Don’t Know

The public materials do not identify the five RICO defendants by name or describe their locations. It is also unclear how durable the disruption will prove: infostealer and dropper operations have historically rebuilt infrastructure after takedowns, and the available reporting does not detail arrests tied to this specific action. The relationship between the 326 servers and 142 domains cited by Europol-coordinated reporting and the “over 200” command-and-control endpoints Microsoft says it disrupted is not spelled out in the sources, which describe overlapping but distinct tallies for the law-enforcement and Microsoft components of the effort.